From: Michael Tremer <michael.tremer@ipfire.org>
Date: Mon, 8 Jul 2013 13:41:15 +0000 (+0200)
Subject: iptables: Create OVPNNAT chain after CUSTOM* chains.
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9a23d28b86382108359c823c58c7f1b2543c5abf;p=people%2Fms%2Fipfire-2.x.git

iptables: Create OVPNNAT chain after CUSTOM* chains.
---

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 1cbca2db85..cc6bebb1db 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -90,11 +90,9 @@ iptables_init() {
 	/sbin/iptables -N OUTGOINGFW
 	/sbin/iptables -A OUTPUT -j OUTGOINGFW
 	/sbin/iptables -t nat -N CUSTOMPREROUTING
-	/sbin/iptables -t nat -N OVPNNAT
 	/sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
 	/sbin/iptables -t nat -N CUSTOMPOSTROUTING
 	/sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
-	/sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
 
 	# Guardian (IPS) chains
 	/sbin/iptables -N GUARDIAN
@@ -107,6 +105,10 @@ iptables_init() {
 		/sbin/iptables -A ${i} -j OVPNBLOCK
 	done
 
+	# OpenVPN transfer network translation
+	/sbin/iptables -t nat -N OVPNNAT
+	/sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
+
 	# IPTV chains for IGMPPROXY
 	/sbin/iptables -N IPTVINPUT
 	/sbin/iptables -A INPUT -j IPTVINPUT